{
  pkgs,
  config,
  lib,
  ...
}:
with lib; {
  options = {
    security.dnscrypt-proxy.enable =
      mkEnableOption "enable dnscrypt-proxy";
  };
  config = mkIf config.security.dnscrypt-proxy.enable {
    networking = {
      nameservers = ["127.0.0.1" "::1"];
      # If using dhcpcd:
      dhcpcd.extraConfig = "nohook resolv.conf";
      # If using NetworkManager:
      networkmanager.dns = "none";
    };

    # Make sure you don't have services.resolved.enable on.
    services.dnscrypt-proxy2 = {
      enable = true;
      settings = {
        ipv6_servers = false;
        require_dnssec = true;

        sources.public-resolvers = {
          urls = [
            "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
            "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
          ];
          cache_file = "/var/lib/dnscrypt-proxy2/public-resolvers.md";
          minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
        };

        # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
        server_names = [
          #"quad9-dnscrypt-ip4-filter-pri"
          "cloudflare"
        ];
      };
    };

    systemd.services.dnscrypt-proxy2.serviceConfig = {
      StateDirectory = "dnscrypt-proxy";
    };
  };
}